Aztec relaunches zk.money on a network whose proving system still has an unfixed critical flaw

Aztec Labs brought back zk.money on Monday, three years after shutting it down, as a self-custodial wallet for private stablecoin payments on the Aztec layer-2 network. Transfers between users hide amounts and counterparties from the public chain, while deposits arriving from Ethereum stay visible, CoinDesk reported. Each transfer must stay below $2,500, and a separate protocol called Oxide runs sealed servers that co-sign every send and withdrawal, according to The Block.

Those limits exist because the underlying network is running with a known defect. Aztec core contributors disclosed a critical vulnerability in the Alpha V5 proving system, found through internal artificial-intelligence-assisted auditing. An attacker could potentially construct a proof that passes verification for a transaction the network should reject, allowing the chain to accept a state transition outside the rules Alpha V5 is supposed to enforce. Contributors also state that they cannot determine from chain history whether anyone used the flawed path, because the system does not record enough information to distinguish ordinary accepted transactions from transactions accepted through the flaw. The fix is deferred to the V6 release, which is meant to include circuit updates that reject proofs tied to the affected system.

This is the failure mode that ordinary rollup safety mechanisms do not catch. Optimistic rollups rely on re-execution and fraud proofs. Validity rollups rely on the soundness of the circuit itself. When the circuit is unsound, that guarantee no longer holds, so the operator must substitute administrative controls, including value caps, application-level guards, and a co-signing service. Aztec is a testnet-stage alpha network and says so, but the design of zk.money shows what that trade-off means in practice. A user gets cryptographic privacy from the public, and for now, a non-cryptographic dependency on an external signer for both liveness and safety.

For context on scale, the layer-2 sector Aztec is entering secures $51.09 billion in total value according to L2Beat, with Base Chain at $16.19 billion and the largest zero-knowledge network in that set, Starknet, at $455.7 million. Aztec is betting that networks need confidential execution more than additional throughput. This disclosure shows what that bet costs while the proving stack is still being built.